An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12…
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution, Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-434 and CWE-79.
Summary
An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library "Create (upload)" permission is supposed to be able to upload PDF files containing JavaScript, and that all files in a public assets folder are accessible to the outside world (unless the filename begins with a dot character). The administrator can choose to allow only image, video, and audio files (i.e., not PDF) if desired.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | @strapi/strapi (npm) | up to 4.1.12 | — | No fix listed | GHSA-4vm8-j95f-j6v5 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- @strapi/strapi (npm) Vendor— Affected up to 4.1.12 Fixed in — No fix listed GHSA-4vm8-j95f-j6v5
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-32114
- 2026-10-03 Alias added: GHSA-4vm8-j95f-j6v5
References
Other 6
- https://github.com/bypazs/strapi
- https://docs.strapi.io/dev-docs/configurations/public-assets
- https://docs.strapi.io/user-docs/users-roles-permissions/configuring-administrator-roles
- https://github.com/strapi/strapi/blob/d9277d616b4478a3839e79e47330a4aaf167a2f1/packages/core/upload/admin/src/components/MediaLibraryInput/index.js#L33
- https://github.com/strapi/strapi/blob/d9277d616b4478a3839e79e47330a4aaf167a2f1/packages/core/content-type-builder/admin/src/components/AllowedTypesSelect/index.js#L14
- https://github.com/strapi/strapi
More Strapi vulnerabilities
- TI-2023-09037 Query filter flaw in Strapi exposes sensitive user details KEVCVSS 3.1HIGH 7.2
- TI-2019-13554 strapi before 3.0.0-beta.17.5 mishandles password resets within… CVSS 3.1CRITICAL 9.8
- TI-2023-19887 Strapi Improper Rate Limiting vulnerability CVSS 3.1CRITICAL 9.8
- TI-2023-08803 Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can… CVSS 3.1CRITICAL 10.0
- TI-2024-25161 Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the… CVSS 3.1HIGH 8.6
- TI-2023-17071 Leaking sensitive user information still possible by filtering on private with prefix fields CVSS 3.1HIGH 8.6
Sources
- CVE-2022-32114 · CVE Program
- CVE-2022-32114 · NVD
- FIRST EPSS
- GHSA-4vm8-j95f-j6v5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences